ipvs: Use READ_ONCE/WRITE_ONCE for ipvs->enable
KCSAN reported a data-race on the `ipvs->enable` flag, which is written in the control path and read concurrently from many other contexts. Following a suggestion by Julian, this patch fixes the race by converting all accesses to use `WRITE_ONCE()/READ_ONCE()`. This lightweight approach ensures atomic access and acts as a compiler barrier, preventing unsafe optimizations where the flag is checked in loops (e.g., in ip_vs_est.c). Additionally, the `enable` checks in the fast-path hooks (`ip_vs_in_hook`, `ip_vs_out_hook`, `ip_vs_forward_icmp`) are removed. These are unnecessary since commit 857ca897 ("ipvs: register hooks only with services"). The `enable=0` condition they check for can only occur in two rare and non-fatal scenarios: 1) after hooks are registered but before the flag is set, and 2) after hooks are unregistered on cleanup_net. In the worst case, a single packet might be mishandled (e.g., dropped), which does not lead to a system crash or data corruption. Adding a check in the performance-critical fast-path to handle this harmless condition is not a worthwhile trade-off. Fixes: 857ca897 ("ipvs: register hooks only with services") Reported-by:<syzbot+1651b5234028c294c339@syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=1651b5234028c294c339 Suggested-by:
Julian Anastasov <ja@ssi.bg> Link: https://lore.kernel.org/lvs-devel/2189fc62-e51e-78c9-d1de-d35b8e3657e3@ssi.bg/ Signed-off-by:
Zhang Tengfei <zhtfdev@gmail.com> Acked-by:
Julian Anastasov <ja@ssi.bg> Signed-off-by:
Florian Westphal <fw@strlen.de>
Loading
Please sign in to comment